Understanding access log columns in Nginx

Better Stack Team
Updated on November 16, 2022

The NGINX logs the activities of all the visitors to your site in the access logs. Here you can find which files are accessed, how NGINX responded to a request, what browser a client is using, IP address of clients and more. It is possible to use the information from the access log to analyze the traffic to find sites usages over time.

Default format

By default, the format of the access log columns is the following:

# nginx.conf
http {
  ...
  log_format combined '$remote_addr - $remote_user [$time_local] '
                      '"$request" $status $body_bytes_sent '
                      '"$http_referer" "$http_user_agent"';
  ...
}
Copied!

As you can see the columns represent the following values in order:

  • $remote_addr - Address of the client
  • $remote_user [$time_local] - Information about user and local time of the client
  • $request - Request that has been sent by the client (GET,POST,PUT …)
  • $status - HTTP status code
  • $body_bytes_sent - The size of the body of the request in bytes
  • $http_referer - Address of the HTTP referer
  • $http_user_agent - User Agent of the client
Got an article suggestion? Let us know
Explore more
Licensed under CC-BY-NC-SA

This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.

We are hiring.

Software is our way of making the world a tiny bit better. We build tools for the makers of tomorrow.

Explore all positions →

Reliability is the
ultimate feature

Delightful observability tools that turn your logs & monitoring into a secret weapon for shipping better software faster.

Explore Better Stack